[dragonwriter]

> I wonder if they could make a case that it violates the HIPAA, since your heartbeat/activity tracker info is on the device?

HIPAA privacy protections only apply to data held by HIPAA "covered entities", which are mostly insurers, health care providers, and their business associates, and they restrict disclosures by those covered entities.